ASD ISM 0408 Logon banner for security responsibilities
What it says
Systems have a logon banner that reminds personnel of their security responsibilities when accessing the system and its resources.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishA logon banner reminds users of their security duties before accessing a system.
A logon banner is a notice that pops up on your screen when you try to log into a computer system, reminding you about your security responsibilities. It is a short reminder that keeping data and systems safe is everyone's job, every time you log in.
Free. Save your status, tasks and notes.
Why it matters
Without a logon banner reminding users of their security duties, personnel might forget or overlook critical security practices, leading to accidental data leaks or policy violations. This oversight could result in unauthorised access, data breaches, or the mishandling of sensitive information.
How to implement
Create a logon banner text that clearly outlines the security responsibilities for users and make sure it is consistent with your organisation's security policies.
Use your system's administration settings to set up the logon banner so it appears every time someone logs in.
For instance, on Windows systems, this can be configured through Local Security Policy settings.
Apply the banner to every logon path into the system and its resources, not just the desktop login screen: include remote access gateways, virtual desktop sessions, administrative consoles and SSH or terminal logons so personnel are reminded of their responsibilities however they connect.
Deploy the logon banner across all devices and systems within your organisation to ensure a uniform reminder of security responsibilities, regardless of where people log in.
Configure the banner on non-Windows systems using their native settings: on macOS place the banner text in /Library/Security/PolicyBanner.txt, and on Linux or UNIX systems set /etc/issue for console logons and the SSH Banner directive for remote logons, then log in to a test device to confirm the banner appears.
Keep it running
The banner applies to every logon path into the system and its resources, including local console logons, remote access sessions, virtual desktops and administrative or privileged logons, so configure it at each of these points rather than only on the desktop login screen. The banner text should remind personnel of their security responsibilities when using the system and its resources, such as appropriate use of the information it holds, accountability for actions taken under their account and reporting of suspected security incidents. Include the banner configuration in standard build images and configuration baselines so newly deployed or rebuilt systems present it from first logon, and confirm it still displays correctly when new operating systems are introduced or existing systems are upgraded.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask to see the logon banner text and configuration settings for each operating system used within the organisation.
Look at
Check that the banner text aligns with current security policies and responsibilities.
Good evidence
A good logon banner presents a clear, consistent message across all systems, matching the documented security policies.
- Check 2 of 5What an auditor asks for
Ask for
Request documentation of how the logon banner is deployed across various systems and devices.
Look at
Ensure the deployment strategy covers all systems, including those used remotely or off-site.
Good evidence
Successful deployment to all systems ensures users are consistently reminded of their security responsibilities wherever they access the system.
- Check 3 of 5What an auditor asks for
Ask for
Ask the system owner to walk through the banner wording and explain which security responsibilities it reminds personnel of.
Look at
Read the text to confirm it actually reminds personnel of their security responsibilities when accessing the system and its resources, rather than being only a legal or ownership notice.
Good evidence
The banner plainly states the responsibilities personnel carry, such as appropriate use of the system and its information, in language a general user can understand.
- Check 4 of 5What an auditor asks for
Ask for
Ask which logon paths into the system present the banner, including remote access, console and administrative or privileged logons.
Look at
Compare the listed logon paths against the system's architecture or access documentation to identify any path that reaches the system or its resources without showing the banner.
Good evidence
Every logon path to the system and its resources presents the banner, with no exceptions for remote, console or privileged access.
- Check 5 of 5What an auditor asks for
Ask for
Request a demonstration showing the logon banner triggering on different operating systems.
Look at
Check if the logon banner reliably appears before login on various system types and environments.
Good evidence
The banner appears uniformly across all systems before login, with no technical failures encountered.
Mappings
Closest match in ISO/IEC 27001: A.5.4, Management responsibilities for information security, which this control supports.
ISO/IEC 27001: 1 mapping
This control supports A.5.4.
ISM-0408 requires a security reminder banner at logon to prompt users about their responsibilities when accessing systems. Annex A 5.4 requires management to ensure personnel apply information security in accordance with organisational policies and procedures, and a logon banner is a practical mechanism to reinforce that expectation at each access attempt. The candidate is about managerial accountability and enforcement, while ISM-0408 is a specific technical/administrative control for user notification.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.